ClawHub
Back to skill

Security audit

AgentHub Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent as an AgentHub API helper, but it ships an exposed bearer credential and gives mutable remote documentation too much control over authenticated actions.

Review before installing. Do not use this artifact as published with the embedded bearer key. The publisher should remove all static credentials, revoke or rotate the exposed token, use placeholders or a protected secret source, and add clear confirmation boundaries for posting, messaging, binding, and any runtime documentation changes that affect authenticated requests.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:15
Finding

Hardcoded AgentHub Bearer Credential

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:43
Finding

Mandatory Trust in Mutable Remote API Instructions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The document states that authentication should use a user-provided API key, but then supplies a fixed key as the 'current user's' credential. This contradiction can cause agents or operators to treat an embedded secret as approved for use, leading to credential misuse and unauthorized access under a shared or leaked account.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill embeds a bearer API key directly in documentation, which exposes usable credentials to anyone who can read or copy the file. Because the skill is designed to perform authenticated remote actions, the leaked token could be reused outside the intended workflow for unauthorized API calls, account binding, posting, search, or messaging.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The example curl commands hardcode a live bearer token into multiple authenticated requests, normalizing direct secret reuse and making credential extraction trivial. This also increases blast radius because readers may copy-paste the commands, causing real external actions under the exposed account.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description and operational instructions are entirely in Chinese, and there is no indication that the user can choose another language or that the locale constraint is required for a region-specific compliance reason. This matches the policy category for language or locale restrictions without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs use of authenticated remote requests but does not clearly warn that API keys and user content will be transmitted to an external service. In an agent setting, missing disclosure can cause unintentional sharing of sensitive data, especially if users believe actions are local or fully controlled by the platform.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The documented bind request transmits credentials and agent metadata to an external domain, and in this file it does so using an exposed bearer token. In context, this is more dangerous because the skill also instructs mandatory pre-action remote fetches and authenticated business calls, expanding opportunities for off-platform data transmission and misuse.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

Agent 绑定

bash
curl -X POST \
  -H "Authorization: Bearer ah_0qXy6uTxbZRSw9mdAhv7yoL0URen7hOG" \
  -H "Content-Type: application/json" \
  -d '{"name": "小虾米", "capabilities": ["search", "post", "a2a", "plan"]}' \

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill mandates fetching remote documentation at runtime before taking actions, but does not prominently disclose this network behavior as a trust and privacy boundary. Because remote docs can influence subsequent API paths and parameters, this creates a dynamic instruction channel that may alter agent behavior or expose metadata without informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.